Information About Microsoft Out-of-Band Security Bulletins

What We Will Cover Review of Out-of-Band release:Review of Out-of-Band release: –New Security Bulletin –New Security Advisory ResourcesResources Questions and answersQuestions and answers

MS10-002: Cumulative Security Update for Internet Explorer (978207) CVESeverityExploitabilityCommentNote CVE Moderate1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Responsibly disclosed CVE Critical1 Consistent exploit code likely. RCE Publicly disclosed Affected Products All currently supported versions of Windows and Internet Explorer Deployment Priority 1 Main Target Workstations and Terminal Servers Possible Attack Vectors An attacker could host a specially crafted website designed to exploit these vulnerabilities through Internet Explorer.An attacker could host a specially crafted website designed to exploit these vulnerabilities through Internet Explorer. This constitutes a browse and own scenario.This constitutes a browse and own scenario. Impact of Attack An attacker who successfully exploited this vulnerability would gain the same rights as the logged on user.An attacker who successfully exploited this vulnerability would gain the same rights as the logged on user. Mitigating Factors An attacker would have no way to force a user to visit their malicious website.An attacker would have no way to force a user to visit their malicious website. By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration.By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e- mail messages in the Restricted sites zone.By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e- mail messages in the Restricted sites zone. Additional Information We are aware of targeted attacks against IE 6.We are aware of targeted attacks against IE 6. Windows Server when installed using server core is not affected.Windows Server when installed using server core is not affected.

Security Advisory : Vulnerability in Windows Could Allow an Elevation in Privilege Microsoft is investigating new public reports of a vulnerability in the Windows kernel. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time.Microsoft is investigating new public reports of a vulnerability in the Windows kernel. We are not aware of attacks that try to use the reported vulnerability or of customer impact at this time. Microsoft released Security Advisory to provide mitigations and workarounds for this vulnerability.Microsoft released Security Advisory to provide mitigations and workarounds for this vulnerability. Microsoft is currently working towards an update to address this vulnerability.Microsoft is currently working towards an update to address this vulnerability. Mitigating Factors:Mitigating Factors: –An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. –Windows operating systems for x64-based and Itanium-based computers are not affected. Workaround: Disable the NTVDM subsystem (users will not be able to run 16-bit applications)Workaround: Disable the NTVDM subsystem (users will not be able to run 16-bit applications)

Bulletin Windows Update Microsoft Update MBSA WSUS 3.0 SMS 2003 with SUIT SMS 2003 with ITMU SCCM 2007 MS YesYesYesYes No 1 YesYes 1.Yes for Internet Explorer 6.0 only in Windows XP SP2, Windows XP SP3 and Windows Server 2003 SP2 Detection & Deployment

Other Update Information BulletinRestartUninstallReplaces MS YesYesMS09-072

Resources Blogs Microsoft Security Response Center (MSRC) blog: Security Response Center (MSRC) blog: Security Research & Defense blog: Research & Defense blog: Microsoft Malware Protection Center Blog: Malware Protection Center Blog: Bulletins, Advisories, Notifications & Newsletters Security Bulletins Summary: mspxSecurity Bulletins Summary: mspx mspx mspx Security Bulletins Search: Bulletins Search: Security Advisories: Advisories: Microsoft Technical Security Notifications: Technical Security Notifications: Microsoft Security Newsletter: Security Newsletter: Security Centers Microsoft Security Home Page: Security Home Page: TechNet Security Center: Security Center: MSDN Security Developer Center: Security Developer Center: Other Resources OOB Update Resources:OOB Update Resources: –IT Pro/Enterprise Guidance: –Consumer Guidance: Update Management Process chmanagement/secmod193.mspxUpdate Management Process chmanagement/secmod193.mspx chmanagement/secmod193.mspx chmanagement/secmod193.mspx Microsoft Active Protection Program Partners: mspxMicrosoft Active Protection Program Partners: mspx mspx mspx

Questions and Answers Submit text questions using the “Ask” button.Submit text questions using the “Ask” button. Don’t forget to fill out the survey.Don’t forget to fill out the survey. A recording of this webcast will be available within 48 hours on the MSRC Blog: recording of this webcast will be available within 48 hours on the MSRC Blog: Register for next months webcast at: for next months webcast at: